                               :FromPort 8080
                               :ToPort 8080}]
                    :Egress $sg-egress-all}]
-
+;Elastic load balancer doc http://docs.aws.amazon.com/ElasticLoadBalancing/latest/APIReference/Welcome.html
  :LoadBalancer {:LoadBalancerName $app-name
                 :Listeners [elb-8080->8080]
                 :SecurityGroups [elb-sg-name $sg-ssh]
                 :Subnets $elb-subnets-be
                 :Scheme "internal"
                 :HealthCheck elb-healthcheck-ping}
-
+;IAM role doc http://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html
  :Role {:RoleName $app-name
-        :Policies  [{:PolicyName "full-access"
-                     :PolicyDocument [{:Action "*",
-                                       :Resource "*"}]}]}
- }
+        :Policies  [{:PolicyName "ec2-describe"
+                     :PolicyDocument [{:Effect "Allow"
+                                       :Action "EC2:Describe*"
+                                       :Resource "*"}]
+; This tool http://awspolicygen.s3.amazonaws.com/policygen.html helps to create policy documents
+                     }]}

                              :FromPort 8080
                              :ToPort 8080}]
                   :Egress $sg-egress-all}
                  {:GroupName $app-name
                   :GroupDescription (str "Security group for application " $app-name)
                   :VpcId $vpc-id

;Here we define a bunch of variables to make our config shorter and easier to understand
(def elb-8080->8080  {:LoadBalancerPort 8080
                      :InstancePort 8080
                      :Protocol "http"
